v0.0.20

⚠️ Read before upgrading

This is a patch release, but it contains two breaking changes. Both are low-impact in practice, but neither is silent if it hits you.

1. Datasource.spec.type is now validated

spec.type accepts only prometheus, mimir, cortex, thanos, victoriametrics. An existing Datasource with any other value becomes invalid and cannot be updated until corrected. Reads continue to work.

spec.type now also defaults to mimir. If you omitted it — which was legal and worked, since everything downstream read only connectionDetails — nothing changes for you and no action is needed.

2. The burn-rate environment variables are renamed

Old	New
ABR_PAGE_SHORT_WINDOW	ABR_PAGE_CRITICAL_BURN_RATE
ABR_PAGE_LONG_WINDOW	ABR_PAGE_HIGH_BURN_RATE
ABR_TICKET_SHORT_WINDOW	ABR_TICKET_HIGH_BURN_RATE
ABR_TICKET_LONG_WINDOW	ABR_TICKET_MEDIUM_BURN_RATE

The old names are no longer read. Defaults are unchanged (14.4, 6, 3, 1). They were named for windows but hold per-tier burn-rate multipliers — both windows in a tier always compared against the same value. They are not exposed through the Helm chart, so you are only affected if you set them as raw environment variables.

---

🌟 Thanos, Prometheus and VictoriaMetrics backends (#151)

Datasource.spec.type now accepts thanos, prometheus and victoriametrics alongside mimir.

Thanos Ruler has no rule-write API, so OSKO does not push to it. It relies on the PrometheusRule it already generates, which prometheus-operator renders into files for the Ruler. Every generated PrometheusRule now carries app.kubernetes.io/managed-by: osko, so point your ruler at it:

apiVersion: monitoring.coreos.com/v1
kind: ThanosRuler
spec:
  ruleSelector:
    matchLabels:
      app.kubernetes.io/managed-by: osko
  ruleNamespaceSelector: {}   # omit and discovery is limited to this namespace only

A null ruleSelector matches no objects, so it must be set. Full example including the queryConfig Secret is in the README.

Also in this change:

• Query URL and tenant header are resolved per backend. Thanos, Prometheus and VictoriaMetrics serve the Prometheus API at the root; Mimir and Cortex under /prometheus. Thanos uses THANOS-TENANT, Mimir and Cortex use X-Scope-OrgID.
• MimirRule and the magic-alerting AlertManagerConfig are now created only on backends that support them — and deleted when a backend change leaves them unjustified. Repointing an SLO from mimir to thanos previously left a MimirRule behind that kept pushing to the old Mimir indefinitely while the SLO reported healthy.
• osko.dev/magicAlerting is unsupported on thanos, prometheus and victoriametrics. Burn-rate alert rules are still generated and still fire; only the Alertmanager routing config is skipped, and the SLO stays Ready.
• DatasourceStatus gained Conditions and Ready, so connection failures are now visible in the resource instead of silently discarded.
• Generated PrometheusRule objects, and the MimirRule objects derived from them, gain app.kubernetes.io/managed-by and osko.dev/slo labels. Expect one update per object on upgrade. The rule payload pushed to Mimir is unchanged.

Fixed along the way: the X-Scope-OrgID header had the wrong casing, and it was sent even when no tenant was configured.

🔧 Burn-rate alerting consolidated (#152)

The alert severity key was being switched on in three separate places, so the window pairing had two sources of truth and could disagree silently — the guard could validate one window pair while the generated expression used another.

One alertTier row now carries the windows, the burn rate and the for duration. Generated PromQL is unchanged, and the existing alerting tests passed without modification.

Closes #135.

🧹 Maintenance

• Removed the unused CreateAlertingRule stub.
• Fixed CRDDirectoryPaths in the internal/controller/openslo envtest suite, which pointed one directory level too shallow. Because the package had no specs, BeforeSuite never ran and the broken path never surfaced. That suite now executes for the first time.